Physiological test credit method

ABSTRACT

A physiological test credit method determines if test credits are available to the monitor and checks if a Wi-Fi connection is available. If test credits are less than a test credit threshold, the monitor connects to a test credit server, processes server commands so as to download test credits and disconnects from the server. In various embodiments, the monitor is challenged to break a server code, the server is challenged to break a monitor code. The server validates monitor serial codes, and saves monitor configuration parameters.

PRIORITY CLAIM AND REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of U.S. patent applicationSer. No. 17/125,713, filed Dec. 17, 2020, titled Physiological TestCredit Method, which is a continuation of U.S. patent application Ser.No. 16/383,380, filed Apr. 12, 2019, titled Physiological Test CreditMethod, which is a continuation of U.S. patent application Ser. No.15/713,275, filed Sep. 22, 2017, titled Physiological Test CreditMethod, which is a continuation of U.S. patent application Ser. No.14/071,447, filed Nov. 4, 2013, now U.S. Pat. No. 9,787,568, titledPhysiological Test Credit Method, which claims priority benefit under 35U.S.C. § 119(e) to U.S. Provisional Patent Application Ser. No.61/722,245, filed Nov. 5, 2012, titled Physiological Test Credit System,the entirety of each of which is hereby incorporated by referenceherein.

BACKGROUND OF THE INVENTION

Pulse oximetry is a widely accepted noninvasive procedure for measuringthe oxygen saturation level of arterial blood, an indicator of aperson's oxygen supply. A typical pulse oximetry system utilizes asensor applied to a patient tissue site. The sensor has emitters thattransmit optical radiation having red and infrared (IR) wavelengths intothe tissue site. A detector responds to the intensity of the opticalradiation after attenuation by pulsatile arterial blood flowing withinthe tissue site. Based on this response, a processor determinesmeasurements for oxygen saturation and pulse rate. In addition, a pulseoximeter may display a plethysmograph waveform, which is a visualizationof blood volume change within the illuminated tissue caused by thepulsatile arterial blood flow over time.

Pulse oximeters capable of reading through motion induced noise areavailable from Masimo Corporation (“Masimo”) Irvine, Calif. Moreover,portable and other pulse oximeters capable of reading through motioninduced noise are disclosed in at least U.S. Pat. Nos. 6,770,028,6,658,276, 6,157,850, 6,002,952 5,769,785, and 5,758,644, which are allassigned to Masimo and are all incorporated in their entireties byreference herein. Corresponding low noise sensors are also availablefrom Masimo and are disclosed in at least U.S. Pat. Nos. 6,985,764,6,813,511, 6,792,300, 6,256,523, 6,088,607, 5,782,757 and 5,638,818,which are all assigned to Masimo and are all incorporated in theirentireties by reference herein. Such reading through motion pulseoximeters and low noise sensors have gained rapid acceptance in a widevariety of medical applications, including surgical wards, intensivecare and neonatal units, general wards, home care, physical training,and virtually all types of monitoring scenarios.

Noninvasive blood parameter monitors capable of measuring bloodparameters in addition to SpO₂, such as HbCO, HbMet and total hemoglobin(Hbt) and corresponding multiple wavelength optical sensors are alsoavailable from Masimo. Noninvasive blood parameter monitors andcorresponding multiple wavelength optical sensors are described in atleast U.S. patent application Ser. No. 11/367,013, filed Mar. 1, 2006and entitled Multiple Wavelength Sensor Emitters and U.S. patentappplication Ser. No. 11/366,208, filed Mar. 1, 2006 and entitledNoninvasive Multi-Parameter Patient Monitor, both assigned to CercacorLaboratories, Inc. (“Cercacor”) Irvine, Calif. and both incorporated intheir entireties by reference herein.

Further, physiological monitoring systems that include low noise opticalsensors and pulse oximetry monitors, such as any of LNOP® adhesive orreusable sensors, SofTouch™ sensors, Hi-Fi Trauma™ or Blue™ sensors; andany of Radical®, SatShare™, Rad-9™, Rad-5™, Rad-5v™ or PPO+™ Masimo SET®pulse oximeters, are all available from Masimo. Physiological monitoringsystems including multiple wavelength sensors and correspondingnoninvasive blood parameter monitors, such as Rainbow™ adhesive andreusable sensors and RAD-57™ and Radical-7™ monitors for measuring SpO₂,pulse rate, perfusion index, signal quality, HbCO and HbMet among otherparameters are also available from Masimo.

SUMMARY OF THE INVENTION

A physiological monitoring system has a sensor that transmits opticalradiation at a multiplicity of wavelengths and a monitor that determinesthe relative concentrations of blood constituents such as HbO₂, Hb,carboxyhemoglobin (HbCO), methemoglobin (MetHb), fractional oxygensaturation, total hemoglobin (Hbt) and blood glucose to name a few. Themonitor advantageously utilizes test credits each of which represent aquantum of currency. A test credit enables the monitor to make aphysiological measurement. In various embodiments different monitorbuttons are pressed to measure different variables. For example, onebutton initiates a SpO₂ measurement and another button initiates a SpCOmeasurement. After the measurement, the number of available test creditsare decremented. The sensor has a memory that stores the test credits,which is decremented after each test. The monitor reads the sensormemory so as to determine the remaining test credits. Physiologicalmonitoring systems include a Masimo Pronto-7® and corresponding rainbow4D™ DC sensor. The Pronto-7 is a palm-sized device designed forquick-and-easy noninvasive total hemoglobin (SpHb®) spot-check testing,along with SpO₂, pulse rate, and perfusion index. A spot check monitorand corresponding credit system is described in U.S. patent applicationSer. No. 12/882,111 titled Spot Check Monitor Credit System, filed Sep.14, 2010 and U.S. patent application Ser. No. 13/110,833 titled SpotCheck Monitor Credit System, filed May 18, 2011, both assigned toCercacor and both incorporated in their entireties by reference herein.

An aspect of a physiological test credit method programmaticallyinitiates wireless communications between a physiological monitor and aremote server in response to available test credits falling below apredetermined threshold so as to download additional test credits fromthe server to the monitor and therefore enable the monitor to performadditional physiological parameter spot-checks on a per test creditbasis. The physiological test credit system establishes a threshold fortest credits stored in an optical sensor attached to a correspondingphysiological monitor. A server is securely connected to the monitorwhen remaining test credits fall below the threshold, and test creditsare downloaded from the server to the monitor accordingly. In variousembodiments, a quantum of test credits is defined and an amount of testcredits equal to the quantum is downloaded each time the remaining testcredits fall below the threshold. A download frequency is definedaccording to the number of times remaining test credits fall below thethreshold in a given period of time. The threshold is adjusted accordingto the download frequency. Alternatively, or in addition to adjustingthe threshold, the quantum is adjusted according to the downloadfrequency.

In various other embodiments, challenges are exchanged between theserver and the monitor so as to verify both the server and the monitor.The challenges may include sending a server challenge code to themonitor and breaking the server challenge code with the monitor andsending a monitor challenge code to the server and breaking the monitorchallenge code with the server. The monitor may be validated utilizingsales data. Also, the server may send a request for device serialnumbers to the monitor, and the serial numbers are matched to salesdata. Further, monitor validation may include sending a server requestfor a zip code to the monitor and matching the zip code to the monitoraccount.

Another aspect a physiological test credit method is determining a testcredit quantity associated with a physiological sensor, comparing thetest credit quantity to a threshold and wirelessly connecting aphysiological monitor to a server if the test credit quantity is belowthe threshold. Server commands are processed so as to downloadadditional test credits to the monitor. Additional test credits aretransferred to the physiological sensor, and the physiological monitoris disconnected from the server.

In various embodiments, the frequency of test credit downloads aretracked and, at least periodically, the amount of additional testcredits downloaded are adjusted according to the frequency. Thethreshold may be adjusted, at least periodically, according to thefrequency. The monitor may be challenged to break a server code beforeany test credits are downloaded to the monitor. The server may bechallenged to break a monitor code before any test credits aredownloaded to the monitor.

A further aspect of a physiological test credit method comprisesestablishing a wireless connection between a monitor and a server;downloading a file of test credits from the server to the monitor;transferring the test credits to a sensor in communications with themonitor; performing a physiological test on a person using the sensor;displaying a result of the physiological test on the monitor; deductinga test credit from the sensor in response to the test; and downloadingan additional file of test credits from the server to the monitor inresponse to the number of test credits remaining in the sensor fallingbelow a threshold.

In various embodiments, a quantity of test credits contained in theadditional file are defined and adjusted according to the time betweenthe downloading of the file and the downloading of the additional file.The threshold is adjusted according to the time between the downloadingof the file and the downloading of the additional file. A two-waychallenge is performed between the monitor and the server beforedownloading a file of test credits. The two-way challenge comprisessending a server challenge code to the monitor; breaking the serverchallenge code at the monitor; sending a monitor challenge code to theserver; and breaking the monitor challenge code at the server. Thesensor and the monitor serial numbers are sent to the server, and theserial numbers are matched with sales data available to the server.Monitor configuration parameters are saved on the server.

Yet another aspect of a physiological test credit system establisheswireless communications between a physiological monitor and a remoteserver. The server downloads test credits from the server to a sensorattached to the monitor. Each test credit allows the monitor to performa spot-check of a physiological parameter. The monitor initiates a testcredit download when the number of available test credits for a sensorfalls below a test credit threshold. The monitor establishes a wirelessconnection with a server. The monitor and server perform a two-waychallenge so that each can verify a connection to an approved device.The server also authenticates the monitor's account on the server. Ifthe challenges and authentication are successful, the server downloads acredit file of test credits to the monitor and its attached sensor. Themonitor and server then disconnect.

An additional aspect of a physiological test credit method establisheswireless communications between a physiological monitor and a remoteserver so as to download test credits to the monitor and its attachedoptical sensor. This enables the monitor to perform physiologicalparameter spot-checks on a per test credit basis. The physiological testcredit method establishes a minimum threshold for test credits stored inan optical sensor attached to a corresponding physiological monitor andconnects a server to the monitor when remaining test credits fall belowthe minimum threshold. The server-monitor connection first requires themonitor and server to exchange mutual code-breaking challenges forserver-monitor verification. The server is then allowed to authenticatethe monitor user account and funds. The server further validates themonitor via sales data. Monitor settings are saved to the server, andserver commands are sent to the monitor.

In various embodiments, a server command is sent to the monitor todownload configuration parameters including the test credit minimumthreshold. The first time a monitor is connected to a server, a one-timemonitor setup is performed. In exchanging challenges a server challengecode is sent to the monitor. The monitor must break the server challengecode. Then the monitor sends a challenge code to the server, which theserver must break. Monitor validation involves a server request fordevice serial numbers from the monitor, which are matched with salesdata. The server also requests a monitor zip code, which is matched withthe monitor account. In various other embodiments, user settings aresaved in the monitor and downloaded to the server. The server sendsmonitor commands that comprise OP commands to perform a monitorfunctions, GUI commands to display results and hybrid command toinitiate a user response.

A further aspect of a physiological test credit method comprisesestablishing a wireless connection between a monitor and a server,performing a two-way challenge between the monitor and the server,authenticating the monitor and validating the monitor. The method mayfurther comprise transferring a credit file of test credits from theserver to the monitor, performing a physiological test, deducting a testcredit corresponding to the test from the monitor account, anddisconnecting the monitor and the server. The server also performs aone-time monitor setup.

In various embodiments, the two-way challenge includes sending a firstchallenge code from the server to the monitor, breaking the firstchallenge code at the monitor, sending a second challenge code from themonitor to the server and breaking the second challenge code at theserver. A monitor validation comprises sending sensor and monitor serialnumbers to the server, matching the serial numbers with sales dataavailable to the server, sending a zip code to the server and matchingthe zip code with account information available to the server.Authenticating may comprise verifying the monitor's user account andfunds. Setting-up the monitor may comprise sending commands and queriesto the monitor so as to receive configuration parameters.

Another aspect of a physiological test credit method determines if testcredits are available to the monitor and checks if a Wi-Fi connection isavailable. If test credits are less than a test credit threshold, themonitor connects to a test credit server, processes server commands soas to download test credits and disconnects from the server. In variousembodiments, the monitor is challenged to break a server code, theserver is challenged to break a monitor code. The server validatesmonitor serial codes, and saves monitor configuration parameters.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart of a monitor-side physiological test creditmethod;

FIGS. 2-3 are flowcharts of a server-side physiological test creditmethod;

FIG. 4 is a flowchart of a two-way challenge for both the server and themonitor to verify their connections;

FIG. 5 is a flowchart of server and monitor account validation;

FIG. 6 is a flowchart of a server one-time monitor setup;

FIG. 7 is a flowchart of server command and monitor acknowledgementcommunications; and

FIGS. 8A-C are flowcharts of server communications of and monitorresponses to operational, GUI and hybrid commands.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIGS. 1-3 illustrate test credit downloads to a monitoring device usinga broadband connection, such as Wi-Fi. In an embodiment, the monitoralways initiates the connection. There are two ways a user can downloadtest credits. “Automatic download” or “Manual download.” For automaticdownloads, the monitor initiates the connection after a test isperformed and the available test credits fall below a predefined updatethreshold. For manual downloads, a user initiates the connection using amonitor menu flow. Accordingly, when a monitor initiates a connection,the initial connection request will have a parameter that describeswhether or not a user manually initiated the connection.

For an automatic download, the monitor initiates a connection to a testcredit server after a test is performed and the test credits drop belowa user-predefined update threshold. In an embodiment, a user-predefinedquantum of test credits (an integer between 1 and N inclusive) isdownloaded each time the update threshold is crossed. In an embodiment,the test credit update threshold and the test credit download quantumare user-defined. In an embodiment, the monitor automatically adjuststhe test credit download quantum and/or the test credit update thresholdaccording to the frequency of test credit usage so as to advantageouslyreduce the frequency of server connections during periods of heavymonitor usage and to advantageously spread-out test credit expendituresduring periods of light monitor usage. In an embodiment, therelationship between test credit download quantum, test credit updatethreshold and test credit usage is user defined.

The process of updating the test credits is done in the background.However, a user will not be able to perform a test during this period.If insufficient test credits are available for auto-download, a servermay query/inform a user about this scenario via GUI commands to themonitor. A monitor initiates a manual download via a local GUI. Then theserver takes over the process as with an auto download mode.

FIG. 1 illustrates a test credit download process from a monitorperspective 100. A monitor test credit download can be initiatedautomatically 110. After a test is complete, the number of availabletests credits on a connected sensor is determined and compared with aspecified update threshold 130. If the available test credits have notfallen below that threshold 132, the update process exits 190. If thenumber of test credits are below that threshold 134, the update processcontinues.

Also shown in FIG. 1, alternatively, a monitor test credit download canbe initiated manually when a user selects a manual test credit updatemenu option 120. For either auto update 110 or manual update 120, Wi-Fiavailability is determined 140. If there is no Wi-Fi 142, the processdisplays an error message 145 and exits 190. If Wi-Fi is available 144,a connection 150 to a server is attempted 152, as described below. Oncea server connection is established 154, the monitor processes commandsfrom the server 160, disconnects 170 and exits 190.

FIGS. 2-3 illustrate a test credit download process from a serverperspective. As shown in FIG. 2, immediately after a Wi-Fi connection isestablished between monitor and server, the server initiates a two-waychallenge with secret hashing 210. Both the server and the monitor use atwo-way challenge to verify their connection with a real monitor orserver, respectively, as described in detail with respect to FIG. 4,below. If the challenge 210 is successful 222, the server determines ifthe update is manual or automatic 230. If automatic 232, the serververifies that the user has turned on the auto download feature 240,prompting the user 250, 260 if necessary. If the auto download remainsoff, the server disconnects 372 (FIG. 3). With either the manual orautomatic update, a secure authentication 270 is performed, whichverifies the user's account and funds. If authentication fails 282, anerror 185 (FIG. 1) is returned to the monitor, an error message isdisplayed 180 (FIG. 1) and the monitor disconnects 170 (FIG. 1). Ifauthentication succeeds 284, validation is performed 301 (FIG. 3).

As shown in FIG. 2, once the user's account is authenticated, thecustomer and/or monitor and sensor are validated 290. In part, this stepinsures that customers, monitors and sensors are paired to theappropriate manufacturer or distributor. This can be a one-timevalidation or a validation for every credit download.

As shown in FIG. 3, when the server recognizes that a monitor isconnecting for the first time 310, the server performs a one-time setup312, as described with respect to FIG. 6, below. If there is anyproblems with the setup 314, the server sends an error 185 (FIG. 1) tothe monitor, drops the connection 370 and exits 380. If the setup 312 iscurrently successful 316 or was previously performed 310, the serverdetermines if the requested number of test credits are available 320. Ifso, the credit file is created and sent to the monitor 330. If not, anerror is returned to the monitor 185 (FIG. 1), and the serverdisconnects 370 and exits 380.

Further shown in FIG. 3, after the monitor receives a credit file fromthe server 330. The monitor sends an ACK and the server receives the ACK340. Using hand-shaking, either zero or all three of the followingoperations take place: the server deducts the credit from user account;the server increments the index count; and/or the monitor updatescredits into the sensor 350.

Additionally shown in FIG. 3, the server drops the connection 370 uponsuccessful completion of the process 360 or if it recognizes any error185 (FIG. 1). The monitor drops the connection 170 (FIG. 1) if theserver does not meet the monitor's challenge or the monitor recognizesan error 185 due to any reason.

FIG. 4 illustrates the two-way challenge 400 for both the server 401 andthe monitor 403 to verify their connections. In order to do that, boththe monitor and the server challenge each other with a code to break,which only a real server and a real monitor know how to do. Inparticular, the server 410 first challenges the monitor 450 to break acode. If the server sees that the device cannot break the code 420, theserver drops the connection. Otherwise, the server 430 asks the monitor470 to send the server a code to break. If the monitor sees that theserver cannot break the code 480, the monitor drops the connection.

FIG. 5 illustrates monitor and user account validation 500. Validationis performed for direct from manufacturer sales or for sales throughdistributors. Several validation methods can be used. Monitor and asensor serial numbers can be compared with sales order records or withtracing data from distributors. A zip code can be used in a mannersimilar to a credit card, i.e. to prevent a user from accessing a wrongaccount due to incorrect recording of serial numbers. An address can beused the same as a zip code, but is more secure. However, an address isprone to user error and free text input is difficult to validate. A webregistration can be used for distribution sales or direct acute caresales.

As shown in FIG. 5, the server 501 requests monitor and sensor data 510.The monitor 503 receives the request 530 and complies 570. The server501 receives the requested data 520, which is compared with serverrecords 530-550 for a match. The server sends an error message 185(FIG. 1) for a monitor to display 180 (FIG. 1), such as Contact TechSupport, if validation data does not match with sales records.

FIG. 6 illustrates a server 610 performing a monitor setup 600. Theserver 601 sends saved settings 610 to the monitor 630. The user canalways change settings online 640. The monitor 650 sends these to theserver to save 620. Any configuration parameters that the monitor needsto remember, such as the low credit threshold, are saved on the serverside 601. The server 601 initially sends a set of commands/queries tothe monitor to get configuration parameters (not shown). Theseparameters include: turn on/off auto-download; define threshold thatinitiates automatic download; and define number of credits toautomatically download. The server may also perform an extra one-timevalidation, using, e.g., a zip code or the last 4 digits of an accountnumber. If any errors occur on the monitor side, a local message isdisplayed and the connection is dropped. If any errors occur on serverside, the server may choose to display an error message on the serverside (via GUI commands) and drop the connection.

FIG. 7 illustrates server command and monitor acknowledgementcommunications 700. Once a connection is established, the server assumesthe master role and the monitor assumes a slave role. The server 701sends commands/queries 710, which the monitor 703 interprets 30. Themonitor 703 performs the commands 740 and acknowledges/answers thequeries 750. Any errors are displayed 760 on the monitor 703. The sensor701 saves the monitor responses 720. In an embodiment, the server sendscommands in a form of HTML-like NMEA data.

FIGS. 8A-C illustrate server commands and monitor responses to thosecommands. The server 801 may send three types of commands including anoperational command 810, a GUI command 840 and a hybrid command 870. Forexample, an operational command 810 may be “get zip code,” or “acceptcredit file and send back ACK.” GUI commands 840 may be, for example,display message “online credit update in progress.” A hybrid command 870may be to display a GUI as well as expect a response from the monitoruser. An example would be a command to display the message “want to turnon auto update?” and wait for a “yes” or “no” response.

As shown in FIGS. 8A-C, the monitor 803 response to an op command 830 isto perform a function 832 and return a result and/or ACK 834. Themonitor 803 response to a GUI command 860 is to display a result and ACK862. The monitor 803 response to a hybrid command 890 is to receive andreturn a user response 892, 894.

A physiological test credit method has been disclosed in detail inconnection with various embodiments. These embodiments are disclosed byway of examples only and are not to limit the scope of the claims thatfollow. One of ordinary skill in art will appreciate many variations andmodifications.

1. (canceled)
 2. A physiological monitoring system configured to performparameter spot-checks on a per test credit basis, the system comprising:a remote server comprising a processor and a memory, wherein the memoryincludes computer-executable instructions; wherein the processor of theremote server is configured to establish secure communication with aphysiological monitor by: initiating a two-way challenge by sending afirst code for the physiological monitor to break in response to thephysiological monitor establishing a connection with the remote server,wherein the physiological monitor is configured to be coupled to asensor and comprising one or more signal processors, the sensorconfigured to be placed at a measurement location of a user, the sensorcomprising a memory configured to store one or more test credits;establishing a secure communication channel between the physiologicalmonitor and the processor of the remote server in response to thetwo-way challenge being met by the remote server and the physiologicalmonitor; and performing an update to the one or more test credits savedon the memory of the sensor via communication with the physiologicalmonitor through the secure communication channel.
 3. The physiologicalmonitoring system of claim 2, wherein the remote server is furtherconfigured to drop the connection with the physiological monitor inresponse to the physiological monitor's inability to break the firstcode.
 4. The physiological monitoring system of claim 2, wherein theremote server is further configured to request the physiological monitorto send a second code for the remote server to break in response to thephysiological monitor breaking the first code.
 5. The physiologicalmonitoring system of claim 4, the monitor is configured to drop theconnection in response to the remote server's inability to break thesecond code.
 6. The physiological monitoring system of claim 2, whereinthe remote server is configured to determine whether the update ismanual or automatic.
 7. The physiological monitoring system of claim 2,wherein the remote server is configured to perform the update byproviding a credit file for the physiological monitor to download. 8.The physiological monitoring system of claim 2, wherein the remoteserver is further configured to validate a monitor or user account byrequesting monitor and sensor data prior to performing the update. 9.The physiological monitoring system of claim 2, wherein the remoteserver acts in a master role and the physiological monitor acts in aslave role once the connection is established.
 10. The physiologicalmonitoring system of claim 2, wherein the first code comprises secrethashing.
 11. The physiological monitoring system of claim 2, wherein thephysiological monitor is configured to establishing the connection withthe remote server in response to the one or more test credits fallingbelow a predefined update threshold.
 12. A method to establish aconnection to update one or more test credits used to perform parameterspot-checks on a per test credit basis, the method comprising:initiating a two-way challenge by a remote server sending a sending afirst code for a physiological monitor to break in response to thephysiological monitor establishing a connection with the remote server,wherein the physiological monitor is configured to be coupled to asensor and comprising one or more signal processors, the sensorconfigured to be placed at a measurement location of a user, the sensorcomprising a memory configured to store one or more test credits;establishing a secure communication channel between the physiologicalmonitor and a processor of the remote server in response to the two-waychallenge being met by the remote server and the physiological monitor;and performing an update to the one or more test credits saved on thememory of the sensor via communication with the physiological monitorthrough the secure communication channel.
 13. The method of claim 12,wherein the remote server drops the connection with the physiologicalmonitor in response to the physiological monitor's inability to breakthe first code.
 14. The method of claim 12, wherein the remote serverrequests the physiological monitor to send a second code for the remoteserver to break in response to the physiological monitor breaking thefirst code
 15. The method of claim 14, wherein the monitor drops theconnection in response to the remote server's inability to break thesecond code.
 16. The method of claim 12, wherein the remote serverdetermines whether the update is manual or automatic.
 17. The method ofclaim 12, wherein the remote server performs the update by providing acredit file for the physiological monitor to download.
 18. The method ofclaim 12, wherein the remote server validates a monitor or user accountby requesting monitor and sensor data prior to performing the update.19. The method of claim 12, wherein the first code includes secrethashing.
 20. The method of claim 12, wherein the physiological monitorestablishes the connection with the remote server in response to the oneor more test credits falling below a predefined update threshold.